Netty Files

Security

• CVE-2026-33871, HTTP/2 CONTINUATION Frame Flood Denial of Service
• CVE-2026-33870, HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

What's Changed

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry lo… by @normanmaurer in https://github.com/netty/netty/pull/16248
• Make RefCntOpenSslContext.deallocate more robust (#16253) by @normanmaurer in https://github.com/netty/netty/pull/16257
• Update to gcc for arm 10.3-2021.07 (#16255) by @normanmaurer in https://github.com/netty/netty/pull/16263
• HTTP2: Correctly account for padding when decompress by @normanmaurer in https://github.com/netty/netty/pull/16265
• Update JDK versions to latest patch releases (#16254) by @normanmaurer in https://github.com/netty/netty/pull/16267
• Backport 4.1: Automatic backporting workflow from 4.1 to 4.2 by @github-actions[bot] in https://github.com/netty/netty/pull/16274
• Backport 4.1: Backport PRs must be created with personal access tokens by @chrisvest in https://github.com/netty/netty/pull/16277
• Backport 4.1: Add more porting workflows by @netty-project-bot in https://github.com/netty/netty/pull/16284
• Backport 4.1: Some polishing of the porting workflows by @netty-project-bot in https://github.com/netty/netty/pull/16292
• Backport 4.1: Fix high-order bit aliasing in HttpUtil.validateToken by @netty-project-bot in https://github.com/netty/netty/pull/16303
• Auto-port 4.1: Support more branch freedom for auto-porting by @netty-project-bot in https://github.com/netty/netty/pull/16310
• fix: the precedence of + is higher than >> (#16312) by @chrisvest in https://github.com/netty/netty/pull/16316
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater th… by @chrisvest in https://github.com/netty/netty/pull/16320
• Auto-port 4.1: Fix flaky PooledByteBufAllocatorTest by @netty-project-bot in https://github.com/netty/netty/pull/16324
• Auto-port 4.1: Fix pooled arena accounting tests by @netty-project-bot in https://github.com/netty/netty/pull/16326
• Auto-port 4.1: Fix RunInFastThreadLocalThreadExtension by @netty-project-bot in https://github.com/netty/netty/pull/16328
• Auto-port 4.1: AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed by @netty-project-bot in https://github.com/netty/netty/pull/16331
• Auto-port 4.1: Mark LoggingHandlerTest with @Isolated to fix flaky build by @netty-project-bot in https://github.com/netty/netty/pull/16340
• Auto-port 4.1: Fix flaky HTTP/2 test by @netty-project-bot in https://github.com/netty/netty/pull/16348
• Auto-port 4.1: Fix flaky RenegotiateTest by @netty-project-bot in https://github.com/netty/netty/pull/16355
• Auto-port 4.1: Fix HTTP/2 push frame test by @netty-project-bot in https://github.com/netty/netty/pull/16353
• SSL test: Don't depend on property value in test (#16346) by @normanmaurer in https://github.com/netty/netty/pull/16362
• Auto-port 4.1: Don't assume CertificateFactory is thread-safe by @netty-project-bot in https://github.com/netty/netty/pull/16364
• AdaptivePoolingAllocator: assign a more explicit value to BuddyChunk.freeListCapacity (#16334) by @chrisvest in https://github.com/netty/netty/pull/16368
• Auto-port 4.1: Add more diagnostic points to PooledByteBufAllocatorTest.createNewThr… by @netty-project-bot in https://github.com/netty/netty/pull/16372
• Fix leak in SniHandlerTest (#16367) by @normanmaurer in https://github.com/netty/netty/pull/16377
• Auto-port 4.1: Stabilize AbstractByteBufTest.testBytesInArrayMultipleThreads by @netty-project-bot in https://github.com/netty/netty/pull/16373
• Remove reference counting from size classed chunks (#16306) by @chrisvest in https://github.com/netty/netty/pull/16379
• Auto-port 4.1: Stabilize AbstractByteBufTest.testToStringMultipleThreads by @netty-project-bot in https://github.com/netty/netty/pull/16384
• Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO… by @samlandfried in https://github.com/netty/netty/pull/16280
• Auto-port 4.1: Fix autoport fetching into the existing branch - again by @netty-project-bot in https://github.com/netty/netty/pull/16417
• Auto-port 4.1: Capture why threads get stuck in testCopyMultipleThreads0 by @netty-project-bot in https://github.com/netty/netty/pull/16419
• Auto-port 4.1: Remove unnecessary array access in DefaultAttributeMap.orderedCopyOnInsert by @netty-project-bot in https://github.com/netty/netty/pull/16421
• Auto-port 4.1: Whitelist JMH annotation processing in microbench module by @netty-project-bot in https://github.com/netty/netty/pull/16430
• Auto-port 4.1: HTTP2: Ensure preface is flushed in all cases by @netty-project-bot in https://github.com/netty/netty/pull/16432
• Auto-port 4.1: Fix UnsupportedOperationException in readTrailingHeaders by @netty-project-bot in https://github.com/netty/netty/pull/16437
• Auto-port 4.1: Fix client_max_window_bits parameter handling in permessage-deflate extension by @netty-project-bot in https://github.com/netty/netty/pull/16435
• Auto-port 4.1: Native transports: Fix possible fd leak when fcntl fails. by @netty-project-bot in https://github.com/netty/netty/pull/16446
• Auto-port 4.1: Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported by @netty-project-bot in https://github.com/netty/netty/pull/16448
• Auto-port 4.1: Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) by @netty-project-bot in https://github.com/netty/netty/pull/16459
• Auto-port 4.1: Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD by @netty-project-bot in https://github.com/netty/netty/pull/16456
• Auto-port 4.1: Epoll: Add null checks for safety reasons by @netty-project-bot in https://github.com/netty/netty/pull/16463
• Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to the same port by @netty-project-bot in https://github.com/netty/netty/pull/16464
• Auto-port 4.1: Epoll: Use correct value to initialize mmsghdr.msg_namelen by @netty-project-bot in https://github.com/netty/netty/pull/16467
• Auto-port 4.1: Epoll: Fix support for IP_RECVORIGDSTADDR by @netty-project-bot in https://github.com/netty/netty/pull/16468
• Auto-port 4.1: AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method by @netty-project-bot in https://github.com/netty/netty/pull/16475
• Auto-port 4.1: AdaptivePoolingAllocator: Fix assertion for size class multiple of 32 by @netty-project-bot in https://github.com/netty/netty/pull/16497
• Epoll: setTcpMg5Sig(...) might overflow (#16511) by @normanmaurer in https://github.com/netty/netty/pull/16520
• Auto-port 4.1: JdkZlibDecoder: accumulate decompressed output before firing channelRead by @netty-project-bot in https://github.com/netty/netty/pull/16532
• Limit the number of Continuation frames per HTTP2 Headers by @normanmaurer in https://github.com/netty/netty/pull/13969
• Stricter HTTP/1.1 chunk extension parsing by @chrisvest in https://github.com/netty/netty/pull/16537

New Contributors

• @github-actions[bot] made their first contribution in https://github.com/netty/netty/pull/16274
• @samlandfried made their first contribution in https://github.com/netty/netty/pull/16280

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.131.Final...netty-4.1.132.Final